Rogue UPnP / SSDP Device
A rogue responder answers every “what devices are here?” query — materialising in your Network folder as a fake router login, a Windows-hash grab, or a malware redirect.
What it is
When Windows wants to find the media players, printers, and routers on your network, it shouts a question over SSDP (UDP port 1900): “who’s out there, and what are you?” Real devices answer only for the type they actually are. A rogue UPnP / SSDP device is a machine on the network running a catch-all responder — software that answers every question, no matter what was asked.
The point of answering everything is to plant a lure. Each reply carries an attacker-chosen name and a LOCATION URL — the address Windows fetches to learn more about the “device.” Point that URL at a fake sign-in-to-your-router page, a booby-trapped path that quietly harvests your Windows login hash, or a malware download, and the rogue device materialises inside your Network folder looking like it belongs.
One machine just volunteered to be every device you were looking for.
How attackers do it
The attacker only needs a foothold on the same network — a laptop on your Wi-Fi, a compromised smart-home gadget — and a catch-all responder. The best-known one is a tool called evil-ssdp: it listens on UDP 1900 and replies to any discovery query with whatever template the attacker chose.
# Attacker starts a catch-all SSDP responder (real tool: evil-ssdp) evil-ssdp -i eth0 -t microsoft-teams # It answers EVERY discovery query -- even for devices that # don't exist -- with a malicious LOCATION URL: # ST: <whatever Windows asked for> # LOCATION: http://<attacker>/present.html <- fake login / hash grab
Because Windows trusts what discovery tells it, the fake device shows up next to your real ones. From there it’s a short hop to a man-in-the-middle position: click the lure, type a password into the fake portal, and the attacker has it — or your machine simply hands over its login hash on contact.
How we detect it
The catch-all is also the tell. A well-behaved network is quiet — a real printer only answers when someone asks for a printer. So WifiThreatWatch sends a discovery query for a device type that cannot exist: a random, made-up name we invent on the spot. No genuine device will ever answer it. A catch-all rogue answers anyway, because it answers everything.
That makes the signal false-positive-proof by construction: any reply to our nonsense query is, by definition, a rogue responder. It’s the same canary idea as our name-poisoning probe — ask for something impossible and see who lies. You can eyeball the native symptoms yourself, too:
# Open the Network folder and look for devices you don't recognise explorer.exe shell:NetworkPlacesFolder # UPnP/SSDP discovery leans on these services -- confirm what's live Get-Service SSDPSRV, upnphost # Check whether SSDP is bound on UDP 1900 on THIS PC # (these show local sockets only, not other hosts on the network) Get-NetUDPEndpoint -LocalPort 1900 -ErrorAction SilentlyContinue netstat -an -p UDP | findstr 1900
How we stop it
Detection tells you a machine on your network is impersonating every device at once — which means it’s time to stop trusting the network and find the culprit. WifiThreatWatch names the responder that replied to a query nothing real should answer.
On a subscription, Active Defense routes your traffic through the encrypted tunnel, so even if you were nudged toward a rogue LOCATION URL, the sensitive parts of your session aren’t the attacker’s to read or redirect. Pair it with a look at every unexpected device on the network to find and remove the host doing the answering.
ARP Spoofing
An attacker on your network impersonates your router to silently intercept everything you send.
Read more →Evil Twin
A fake access point broadcasts your network’s name to lure your device onto attacker-controlled hardware.
Read more →Rogue Device
A device you never authorized quietly joins your network and gains a foothold on your LAN.
Read more →